Advisories · Technology
Red Hat OpenStack Platform 17.1.
Every CVE that names Red Hat OpenStack Platform 17.1 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.5 High
Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.7
- Code injection
- CVSS 8.8 High
Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution
- Red Hat Migration Toolkit for Applications 8
- Red Hat Migration Toolkit for Virtualization
- Path traversal
- CVSS 5.9 Medium
Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array
- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux 10
- Denial of service
- CVSS 7.3 High
Leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan_mysql runs mysqld --validate-config as root and can load mysql-writable plugins
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux 9.6 Extended Update Support
- Privilege escalation
- CVSS 6.5 Medium
Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Broken access control
- CVSS 6.8 Medium
Community.general: community.general: ocapi module_utils (ocapi_command, ocapi_info) hardcode validate_certs=false with no override, enabling tls man-in-the-middle and credential disclosure
- Red Hat Ceph Storage 5
- Red Hat Ceph Storage 9
- Weak cryptography or TLS
- CVSS 8.1 High
Community.general: community.general: memcached cache plugin deserializes untrusted pickle data from memcached, enabling cache-poisoning remote code execution on the ansible controller
- Red Hat Ceph Storage 5
- Red Hat Ceph Storage 9
- Insecure deserialization
- CVSS 5.5 Medium
Ansible-collection-community-general: community.general: ipa_getkeytab does not set no_log on the bind_pw parameter, disclosing the ipa bind password in logs and process listings
- Red Hat Ceph Storage 5
- Red Hat Ceph Storage 9
- CWE-214
- CVSS 7.3 High
Ansible-collection-ansible-posix: ansible.posix authorized_key: local privilege escalation via symlink-following chown
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 10.0 Extended Update Support
- Path traversal
- CVSS 5.9 Medium
Openvswitch: open vswitch: denial of service via malformed ftp epasv command
- Red Hat Fast Datapath for RHEL 7
- Red Hat Fast Datapath for RHEL 8
- Memory corruption
- CVSS 4.8 Medium
Unbound: heap-buffer-overflow in unbound
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Memory corruption
- CVSS 2.8 Low
Unbound: null pointer dereference in unbound
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Memory corruption
- CVSS 7.5 High
Etcd: incomplete fix for cve-2021-44716 in openstack platform
- Red Hat OpenStack Platform 16.1
- Red Hat OpenStack Platform 16.2
- Denial of service
- CVSS 7.5 High
Etcd: incomplete fix for cve-2022-41723 in openstack platform
- Red Hat OpenStack Platform 16.1
- Red Hat OpenStack Platform 16.2
- Denial of service
- CVSS 5.5 Medium
Tripleo-ansible: bind keys are world readable
- Red Hat OpenStack Platform 17.1 for RHEL 8
- Red Hat OpenStack Platform 17.1 for RHEL 9
- CWE-1220